
Security News
Axios Supply Chain Attack Reaches OpenAI macOS Signing Pipeline, Forces Certificate Rotation
OpenAI rotated macOS signing certificates after a malicious Axios package reached its CI pipeline in a broader software supply chain attack.
A command-line interface for the QVAC ecosystem. QVAC CLI provides tooling for building, bundling, and managing QVAC-powered applications.
This package is published to npm as @qvac/cli and lives in the QVAC monorepo at packages/cli. Older instructions may refer to the deprecated qvac-cli package name—use @qvac/cli instead.
Install globally:
npm i -g @qvac/cli
Once installed, use the qvac command:
qvac <command>
Or run directly via npx:
npx @qvac/cli <command>
bundle sdkGenerate a tree-shaken Bare worker bundle containing the plugins you select (defaults to all built-in plugins).
qvac bundle sdk [options]
What it does:
qvac.config.* from your project root (if present)plugins array (defaults to all built-in plugins if omitted)bare-pack --linkedaddons.manifest.json from the bundle graphOptions:
| Flag | Description |
|---|---|
--config, -c <path> | Config file path (default: auto-detect qvac.config.*) |
--host <target> | Target host (repeatable, default: all platforms) |
--defer <module> | Defer a module (repeatable, for mobile targets) |
--quiet, -q | Minimal output |
--verbose, -v | Detailed output |
Examples:
# Bundle with default settings (all platforms)
qvac bundle sdk
# Bundle for specific platforms only
qvac bundle sdk --host darwin-arm64 --host linux-x64
# Use a custom config file
qvac bundle sdk --config ./my-config.json
# Verbose output for debugging
qvac bundle sdk --verbose
Output:
| File | Description |
|---|---|
qvac/worker.entry.mjs | Standalone/Electron worker with RPC + lifecycle |
qvac/worker.bundle.js | Final bundle for mobile runtimes (Expo/BareKit) |
qvac/addons.manifest.json | Native addon allowlist for tree-shaking |
Note: Your project must have
@qvac/sdkinstalled.
The CLI reads configuration from qvac.config.{json,js,mjs,ts} in your project root.
If no config file is found, the CLI bundles all built-in plugins.
Note:
qvac.config.tsis supported viatsxinternally (no user setup required).
This file is primarily the SDK runtime config, but qvac bundle sdk also reads this bundler-only key (ignored by the SDK at runtime):
| Key | Type | Required | Description |
|---|---|---|---|
plugins | string[] | No | Module specifiers, each ending with /plugin (defaults to all built-in plugins) |
Custom plugin contract: custom
*/pluginmodules must default-export the plugin object.
Built-in plugins:
@qvac/sdk/llamacpp-completion/plugin
@qvac/sdk/llamacpp-embedding/plugin
@qvac/sdk/whispercpp-transcription/plugin
@qvac/sdk/parakeet-transcription/plugin
@qvac/sdk/nmtcpp-translation/plugin
@qvac/sdk/onnx-tts/plugin
@qvac/sdk/onnx-ocr/plugin
@qvac/sdk/sdcpp-generation/plugin
Example configurations:
// qvac.config.json - LLM only
{
"plugins": [
"@qvac/sdk/llamacpp-completion/plugin"
]
}
// qvac.config.json - Multiple plugins
{
"plugins": [
"@qvac/sdk/llamacpp-completion/plugin",
"@qvac/sdk/whispercpp-transcription/plugin",
"@qvac/sdk/nmtcpp-translation/plugin"
]
}
Prerequisites:
Run locally:
# From packages/cli after a build
bun run build
node ./dist/index.js bundle sdk
# Or link globally for testing
npm link
qvac bundle sdk
This project is licensed under the Apache-2.0 License - see the LICENSE file for details.
FAQs
Command-line interface for the QVAC ecosystem
We found that @qvac/cli demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 3 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
OpenAI rotated macOS signing certificates after a malicious Axios package reached its CI pipeline in a broader software supply chain attack.

Security News
Open source is under attack because of how much value it creates. It has been the foundation of every major software innovation for the last three decades. This is not the time to walk away from it.

Security News
Socket CEO Feross Aboukhadijeh breaks down how North Korea hijacked Axios and what it means for the future of software supply chain security.